Guarded filesystem directory joins for the media downloader. More...

#include <stddef.h>
#include "mdl_storage.h"

Include dependency graph for mdl_pathfs.h:

This graph shows which files directly or indirectly include this file:

Functions
bool	mdl_join_dir_under (mdl_storage_t storage, const char parent_abs, const char seg, char out, size_t cap)
	Join seg under parent_abs, create it, and verify it stays inside.

Detailed Description

Guarded filesystem directory joins for the media downloader.

The download orchestration composes a chapter or combined output directory under a series directory from an untrusted, scraped leaf name. This module holds the one filesystem-touching join that couples the lexical mdl_path_join guard (a .., separator-bearing, or absolute segment can never compose a path) with the injected filesystem's confined-root and no-symlink-walk guarantees. It is kept out of the CLI's translation unit so the pure lexical predicates in mdl_sanitize stay filesystem-free and this filesystem policy has exactly one home.

Copyright: Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file mdl_pathfs.h.

Function Documentation

◆ mdl_join_dir_under()

bool mdl_join_dir_under	(	mdl_storage_t *	storage,
		const char *	parent_abs,
		const char *	seg,
		char *	out,
		size_t	cap )

Join seg under parent_abs, create it, and verify it stays inside.

The single guarded directory join every series_dir/chapter_dir path routes through. mdl_path_join refuses a traversal, separator-bearing, or over-long seg before any mkdir, so a scraped .. can never name a directory. The filesystem adapter then confines the path beneath its bound root and refuses symbolic-link traversal. Any stat or create failure returns false without printing; the composition layer owns diagnostics.

Parameters

[in,out]	storage	Initialized portable filesystem binding.
[in]	parent_abs	Canonical portable parent directory.
[in]	seg	Sanitised child segment (a leaf or a slug-derived name).
[out]	out	Buffer receiving the joined directory path.
[in]	cap	Capacity of `out` in bytes.

Returns: Whether out names a directory contained under parent_abs.

Return values

true	The child directory exists beneath `parent_abs`.
false	Invalid input, unsafe/over-long `seg`, missing parent, or a backend stat/create failure.

Precondition: parent_abs is an existing canonical directory below the bound root.; seg and out are non-NULL; seg is NUL-terminated.

Postcondition: On true, out names an existing directory under parent_abs.; On false, no path outside parent_abs is created or used.

Note: Not thread-safe because one storage binding owns shared adapter state.

See also: mdl_path_join The lexical join that rejects the traversal segment.

Since: 0.1.0

Definition at line 15 of file mdl_pathfs.c.

References fw_fs_stat_t::exists, mdl_storage_t::fs, fw_fs_mkdir(), fw_fs_stat(), k_fw_fs_node_directory, k_ra8_err_exists, k_ra8_ok, mdl_path_join(), fw_fs_t::names, and fw_fs_stat_t::type.

Referenced by internal_mdl_fetch_resolve_dest(), mdl_fetch_run(), and priv_mdl_app_prepare_series_dir().

Functions

Detailed Description

Function Documentation

◆ mdl_join_dir_under()